Fix vfprintf call (2nd, 3rd args reversed)